In modern computing environments, the management of the information infrastructure and assets of a company is a complex and expensive task. In order to address security risks, enterprises will commonly define an IT governance model, ie rules to be applied to usage of their computing infrastructure in order to protect company information and assets. Such rules might be for instance “company employees may not have FTP access to external FTP servers unless specifically authorised to do so”, for instance. Based on these high-level policy objectives, a more detailed set of technical specifications will need to be defined and deployed to give effect to the policy. These specifications will address the configuration of computing devices such as servers, databases, routers or firewalls. It is these latter specific technical specifications that will be referred to in the following as “security policies”.
Deploying and managing such security policies within a large enterprise infrastructure is a very complex task. Any implementation errors or uncontrolled modification of the security policies could put the enterprise electronic assets at risk. Therefore, numerous checks and approvals are typically required before any change in the security policies can be effective. This situation has to be balanced against the need for speed and responsiveness to business needs. As a result, deploying and managing security policies in a large and distributed enterprise is both time-consuming and resource intensive.
Several issues make the creation and management of these security policies difficult. First, creating the security policies is a labour-intensive process requiring significant skill. Second, selecting an appropriate set of detailed controls for each type of computing platform to enforce the security policy so that it is aligned with the IT governance model requires even more detailed analysis by someone that understands that particular type of system. Once selected, these controls may need to be broken down into a set of manual steps that must be performed most of the time locally by a system administrator responsible for the platforms being protected.
A variety of measures have already been proposed to deal with these difficulties. For instance, systems are known that enable to electronically create a security policy document, which contains appropriate controls required to enforce the security policy on various computing platforms. For instance USP 2003/0065942 describes software that creates a direct link between the security policy documents that are created and distributed to people and the control files sent to computers on the network.
A policy server product is available from Solsoft Inc that enables a security policy to be designed and applied on a virtual network.
The present applicant's U.S. patent application 2002/0099823 describes a method of creating a structured access list template for use in deploying a network security policy in a large partitioned network.
However, most approaches to security policy management are in practice project-oriented: that is each new implementation or deployment even if it may be partially or even wholly automated, and its relationship to the IT governance model, is considered individually. It is therefore not always convenient to leverage from previous implementations, and it can be time-consuming to evaluate the risks associated with proposed changes within the enterprise.
Moreover, the role of the person who has the job of deciding what is permitted through any particular policy boundary is very often tied to a physical location: the network subnet, or the place in the topology where the boundary physically exists. This can make the deployment of policies in a large and geographically distributed enterprise resource intensive and inefficient.
An object of this invention is to mitigate the above drawbacks associated with known approaches.